Why is AWS WAF Best for Web App Security?

There is a spike in the number of cyber attacks that cause businesses worldwide to lose billions. The majority of these attacks focus on making web apps weak. Still, businesses do not prioritize strengthening the security of these applications as 98% of them are vulnerable to cyber attacks. Here, AWS WAF is one of the biggest solutions available to protect web apps from common web exploits. In this blog, we will cover what WAF is, how it works, and why it is important.

What is AWS WAF?

AWS WAF stands for Web Application Firewall which is the service that helps businesses to keep their web apps secured. This service is useful to avoid common web exploits that could affect the availability and performance of a web application. AWS WAF is popular among businesses to monitor and control bot traffic. This has certain parameters based on which incoming web requests are either approved or rejected.

WAF protects web applications against attacks like XSS (cross-site scripting), SQL injections, Cross-Site Forgery, DDoS (distributed denial of service), and many others.

How Does AWS WAF Work?

AWS WAF makes use of web access control lists (ACLs) to determine how HTTP(S) requests to your web applications are processed. Based on the defined “rules” within web ACLs, these requests can be approved or rejected, among other functions. 

AWS WAF has three main components through which HTTP(S) requests are managed on your protected resources. These components are:

Rules

Rules are the building blocks of AWS Web Application Firewall traffic filtering system. They are the most basic unit of defining the inspection criteria of the web requests and the subsequent action to be taken based on its assessment. Rules don’t exist on their own in AWS WAF. They are always part of web ACLs. 

Rules essentially have two parts; rule statement and rule action.

Rule Statement

This part of the rule defines the criteria based on which a received web request to your protected resource (web application) is to be assessed. A rule statement can contain other statements allied with it through AND, OR, NOT logical connectors. 

The criteria or group of criteria based on which a web request is assessed are:

• IP Address
• Geographic origin
• URI Path
• All query parameters
• Web request body
• Web request JSON body

Rule Action

This part of the rule instructs AWS WAF on what action to take regarding a web request after it has been inspected. Based on whether the web request matches the rule statement, a web request can be:

• Allowed 
• Blocked
• Counted
• Challenged (through CAPTCHA puzzles and silent challenges)

Rule Groups

Rule groups are a collection of different rules targeting a specific security concern like malicious scripts, SQL injections, etc. Rule groups can be reused across different web ACLs. AWS WAF offers the option to deploy pre-existing managed rule groups or build custom rule groups. Let us understand the key points of difference between managed and custom rule groups:

Managed Rule Groups

Managed rule groups are pre-configured and ready-to-use rule groups written and maintained by AWS or AWS Marketplace sellers. Many AWS and AWS Marketplace rule groups are automatically updated in light of new security concerns, saving you time. AWS-managed rule groups offer a distinct advantage over others. Due to AWS’ exclusive access to private disclosure communities, AWS is informed of new vulnerabilities in web applications before they are even made public. This ensures you have rule groups that stay ahead of all possible web application attacks and are updated automatically. 

Custom Rule Groups

AWS WAF lets you build your own rule groups to allow you fine-grained control over monitoring and filtering web traffic. This lets you customize the security of your web applications based on your unique needs. As compared to the managed rule groups, custom rule groups give you access to all the rules within them. 

Web ACLs

Web Access Control Lists (ACLs) are a collection of rule groups and at times, individual rules. Web ACLs are the AWS WAF component directly attached to the resources (web apps) that you want to protect against malicious attacks. Web ACLs help you protect your other AWS resources such as Amazon CloudFront, Amazon Cognito, Amazon API Gateway, and many others.

With AWS WAF web ACLs, you can define rules to examine web requests based on specific characteristics such as:

• The IP address of the request
• Country/geographic location
• String match or regex match
• Size of a particular part of the request
• Detection of malicious SQL code or scripting
• A specified number of requests in a minute

The AWS Web Application Firewall console has the option to view the web traffic metrics of all the web ACLs in use as well. 

Applications of AWS WAF

We have delved into the complexities of AWS WAF. So what good is it? Let us explore the applications of this intricately designed Amazon Web Service.

Web Traffic Filtering

With AWS WAF’s managed and custom rule groups, you get nuanced control over monitoring and authorizing web requests. Web traffic filtering helps protect your web applications from malicious attacks that could result in:

• Data leaks
• Loss of productivity
• Malfunction of web applications 
• Increased recovery costs

Bot Control

Bot traffic refers to all the traffic generated through non-human sources on a web application. Several pervasive bots consume server resources like bandwidth resulting in slower load times, increased hosting costs, and even causing your site to crash. Such bots can also distort web traffic analytics. 

AWS WAF’s managed bot control group offers protection against bots on two levels; basic and targeted. For bots that identify themselves, the rule group assigns them labels and filters well-intentioned bots. For bots that don’t self-identify, targeted security checks including behavior heuristics, fingerprinting, browser interrogation, and other techniques are deployed to ensure the safety of such bots.  

Account Takeover Fraud Prevention

AWS WAF protects accounts hosted on your web applications and prevents unauthorized access to information and data breaches through the AWS Web Application Firewall Fraud Control Account Takeover Prevention (ATP) managed rule group. The ATP managed rule group tracks, labels, and manages login requests that might be account takeover attempts. The rule group does this by request and response inspection.

Account Creation Fraud Prevention

Similar to account takeover fraud in some respects, account creation fraud is when there is an attempt to create one or multiple fake accounts on your web applications. These bogus accounts can be used for illegal activities such as impersonation, phishing, etc. AWS WAF offers the Account Creation Fraud Prevention (ACFP) managed rule group to monitor and block such bogus account creation attempts.

Centralized and Customized Management

Managing your web traffic and protecting web applications has never been easier and more empowering. You get pre-made rule groups as well as the option to create rules that offer you unparalleled access to traffic monitoring and management. AWS WAF is thus a one-stop solution for everyone with web application resources that they want to protect against a plethora of cyberattacks.

Integration with other Amazon Web Services

Like most AWS offerings, the Web Application Firewall of AWS too can be integrated and used with other Amazon Web Services. It can be integrated with AWS WAF, AWS Shield Advanced, Amazon VPC security groups, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall. 

AWS Firewall Manager automates security across your AWS infrastructure and resources. You just have to set the rules once, and the service takes care of applying them to all your accounts and resources, even as you expand. 

Monitoring

It is important to establish a baseline for the normal performance of your web applications. Once this is done, the Web Application Firewall of AWS lets you monitor and compare historical monitoring data with current performance data. This helps identify normal performance and identify anomalies in web traffic and application performance. 

AWS WAF offers automated tools like Web ACL traffic overview dashboards, Amazon CloudWatch logs, Amazon CloudWatch Config, Amazon CloudWatch Alarms, and many others to monitor performance. It also offers manual tools through the AWS Management Console Dashboards to cover items that could be missed by the automated tools.

Conclusion

In conclusion, we can see that AWS WAF is an indispensable partner in the fight against web application attacks. It is easy to set up, maintain, and configure based on your unique web application requirements. Its integration with other AWS services like CloudFront and API Gateway makes it easy to deploy and manage, while its flexibility and scalability ensure that it can adapt to the evolving security needs of your applications. To secure your web app, get AWS WAF by VideoCrypt – a certified AWS WAF service delivery partner.